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METHOD, SYSTEM. AND APPARATUS FOR PROVIDING SELF- 
DESTRUCTING ELECTRONIC MAIL MESSAGES 



Technical Field 

The present invention generally relates to the field of electronic messaging. 
More specifically, the present invention relates to the field of providing electronic mail 
messages that self-destruct after a specified time period has elapsed. 

Background of the Invention 

Electronic mail ("e-mail") has become a pervasive method of communication 
for many computer users worldwide. Because e-mail provides a quick and easy method 
of communication that was not previously possible, e-mail is now commonly used in 
the home and in the workplace to send all types of communications ranging from trivial 
notes to highly sensitive business communications. However, although conventional e- 
mail systems are fast and convenient, these systems are not suitable for transmitting all 
types of information. 

For instance, the ease with which e-mail messages may be forwarded, saved, 
and otherwise distributed make conventional e-mail systems inappropriate for highly 
confidential or proprietary information. Moreover, in conventional e-mail systems the 
sender of an e-mail message cannot restrict the operations that may be subsequently 
performed on an e-mail message. Therefore, once an e-mail message has been sent, the 
message may be subsequently forwarded to other e-mail users, printed, saved, copied, 
moved, and otherwise replicated. The inability to control the number and type of 
operations that may be subsequently performed on a sent e-mail message makes 
conventional e-mail systems unsuitable for sending confidential information for which 
absolute control of distribution is a necessity. 

Conventional e-mail systems may also be inappropriate for sending confidential 

or proprietary information because these systems do not allow the sender of an e-mail 

message to control the lifespan of the e-mail message. E-mail messages may, therefore, 

languish in a recipient's e-mail "in-box" or on an e-mail server computer for months or 
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even years. Some e-mail systems will allow an e-mail recipient to specify that 
messages should be deleted after a certain amount of time. However, these systems do 
not allow the sender to specify a time for destruction of the sent e-mail message. 
Therefore, an e-mail sender cannot be certain that a sent e-mail message containing time 
sensitive information will ever be deleted. 

Therefore, in light of the above-described problems, there is a need for a 
method, system, and apparatus for providing self-destructing e-mail messages that 
allows a user to specify a time for the destruction of a sent e-mail message and that will 
destroy all instances of the e-mail message when the specified time arrives. Moreover, 
there is a need for a method, system, and apparatus for providing self-destructing e-mail 
messages that restricts the number and type of operations that may be subsequently 
performed on a sent e-mail message, thereby restricting the ability of a recipient to 
replicate the message. 

Summary of the Invention 

Embodiments of the present invention solve the above-described problems by 
providing a method, system, and apparatus for providing self-destructing e-mail 
messages that allow a time to be specified for the destruction of a sent e-mail message 
and that destroy all instances of the e-mail message when the specified time arrives. 
Moreover, embodiments of the present invention also provide a method, system, and 
apparatus for providing self-destructing e-mail messages that restrict the number of 
operations that may be subsequently performed on a sent e-mail message. For instance, 
operations for saving, forwarding, printing, copying, or otherwise duplicating the e-mail 
message may be prohibited. 

Generally described, one embodiment of the present invention comprises a 
system for providing self-destructing and operation-limited e-mail messages. The 
system provided according to this embodiment comprises an e-mail client application 
program for sending and receiving self-destructing e-mail messages. The e-mail client 
application provides a user interface for sending self-destructing e-mail messages. In 
particular, when a sender requests to send a self-destructing e-mail message, the sender 




is prompted for the conventional information necessary to send an e-mail message such 
as the recipient's e-mail address, e-mail addresses for carbon copy or blind carbon copy 
recipients, a subject for the e-mail message, and an e-mail message body. Additionally, 
the sender is prompted to identify a period of time within which the e-mail message 
5 should be destroyed. 

In various embodiments of the present invention, the period of time within 
which the e-mail message should be destroyed may be specified as an elapsed period of 
time measured from the time the e-mail message is sent. Alternatively, the sender may 
specify a particular date on which the message should be destroyed. The sender may 
H 10 also specify that the e-mail message be deleted as soon as it has been opened and closed 

y by the recipient. In various embodiments, the sender may specify that a return receipt 

*p be provided when the recipient has read the message and that a confirmation e-mail 

*jS message be provided to the recipient when the e-mail message has been deleted. In this 

manner, a sender can learn when a message has been received and a recipient can learn 
15 of the existence of an e-mail message that was deleted before they had an opportunity to 
read it. 

Once the sender has specified each of the options for the e-mail message to be 
sent, the e-mail client application sends a request to an e-mail server application to send 
the e-mail message as a self-destructing e-mail message. The request includes the 
20 message body and delivery information, including the selected destruction date, return 
receipt, and confirmation e-mail options. The self-destructing e-mail message is then 
delivered by the e-mail server application to the appropriate recipients. 

In the embodiments of the present invention described herein, the e-mail client 
application may also receive self-destructing e-mail messages. In particular, the e-mail 
25 client application may receive self-destructing e-mail messages from the e-mail server 
application. If the e-mail client application receives a self-destructing e-mail message 
from the e-mail server computer, the e-mail client application identifies the destruction 
date associated with the e-mail message and destroys the e-mail message at the 
specified time. The e-mail message will be destroyed by the e-mail client application 
30 whether or not the message has been read. Alternatively, if the e-mail message 
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specifies that it should be deleted after it has been read, the e-mail client application will 
destroy the e-mail message once it has been opened and closed by the recipient. All 
instances of the e-mail message are deleted from the recipient's computer. 

According to one embodiment of the present invention, the e-mail client 
5 application is also operative to limit the number and type of operations that may be 
performed on a self-destructing e-mail For instance, when a request is made by the 
recipient to perform an operation on the e-mail message, the e-mail client application 
may determine if the operation is permitted. If the operation is not permitted, the e-mail 
client application may prohibit the operation from being performed on the e-mail 
10 message. In this manner, the e-mail client application may prevent operations from 
being performed on self-destructing e-mail messages such as printing, forwarding, 
saving, moving, or other types of operations for duplicating the content of the e-mail 
message. 

The system provided according to one embodiment of the present invention also 
15 includes an e-mail server application. According to various embodiments of the present 
invention, the e-mail server application receives requests from the e-mail client 
application to transmit self-destructing e-mail messages. The e-mail server application 
receives such requests and sends the self-destructing e-mail messages to the intended 
sy recipients. Additionally, the e-mail server application may monitor the destruction 

20 dates for received messages and destroy any instances of self-destructing e-mail 
messages contained on an e-mail server computer when the specified dates arrive. 
Additionally, the e-mail server application may instruct the e-mail client application to 
destroy e-mail messages and may transmit a confirmation e-mail message to the 
intended recipient of a destroyed message when the message is deleted. 
25 Various embodiments of the present invention also provide a method, a 

computer-controlled apparatus, and a computer-readable medium for providing self- 
destructing e-mail messages. Additional aspects of the various embodiments of the 
present invention will be described further with reference to the Detailed Description 
that follows. 
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Brief Description of the Drawings 

In the drawings, which are not necessarily drawn to scale, like numerals describe 
substantially similar components throughout the several views. Like numerals having 
different letter suffixes represent different instances of substantially similar 
components. The drawings illustrate generally, by way of example, but not by way of 
limitation, various embodiments discussed in the present document. 

FIGURE 1 is a block diagram showing an illustrative operating environment and 
network architecture utilized in an embodiment of the present invention; 

FIGURE 2 is a block diagram illustrating a computer architecture for an e-mail 
server computer provided according to one embodiment of the present invention; 

FIGURE 3 is a block diagram illustrating a computer architecture for an e-mail 
client computer utilized in an embodiment of the present invention; 

FIGURE 4 is a user interface diagram illustrating a user interface for an e-mail 
client application provided in an embodiment of the present invention; 

FIGURE 5 is a user interface diagram showing a user interface for sending a 
self-destructing e-mail message in an embodiment of the present invention; 

FIGURE 6 is a user interface diagram showing a user interface for setting a time 
period for the destruction of a self-destructing e-mail message in an embodiment of the 
present invention; 

FIGURE 7 is a user interface diagram showing a dialog box for providing a 
security warning in an embodiment of the present invention; 

FIGURE 8 is a state diagram illustrating aspects of the operation of an e-mail 
client application provided in an actual embodiment of the present invention; 

FIGURE 9 is a state diagram illustrating additional aspects of the operation of 
an e-mail client application provided in an actual embodiment of the present invention; 
and 

FIGURE 10 is a state diagram illustrating aspects of the operation of an e-mail 
server application provided in an actual embodiment of the present invention. 



Detailed Description of an Illustrative Embodiment 

In the following detailed description, reference is made to the accompanying 
drawings which form a part hereof, and in which is shown by way of illustration 
specific embodiments or examples. These embodiments may be combined, other 
5 embodiments may be utilized, and structural, logical, and electrical changes may be 
made without departing from the spirit and scope of the present invention. The 
following detailed description is, therefore, not to be taken in a limiting sense, and the 
scope of the present invention is defined by the appended claims and their equivalents. 
As described briefly above, embodiments of the present invention include a 
I* 10 method, system and apparatus for providing self-destructing e-mail messages. 

9 Referring now to FIGURE 1, an illustrative operating environment and network 

=p architecture for implementing the various embodiments of the present invention will be 

m described. As shown in FIGURE 1, an e-mail server computer 102 and a client 

IJj computer 106 A are connected via an intranet 104. The client computer 106 A comprises 

■ 15 a standard personal computer having a network connection and operative to 

communicate with the e-mail server computer 102 via the intranet 104. The client 
computer 106A also includes an e-mail client application program configured for 
sending and receiving self-destructing e-mail messages. The e-mail client application 
may also be configured for sending and receiving non self-destructing e-mail messages 
20 and for performing other types of functions typically associated with e-mail client 
application programs. Additional details regarding the operation of the client computer 
106 A are described below with reference to FIGURES 3-9. 

The e-mail server computer 102 comprises a standard network server computer 
connected to the intranet 104. The e-mail server computer 102 may also be connected 
25 to an extranet, such as the Internet 1 10, through the gateway device 108. As known to 
those skilled in the art, the gateway device 108 provides an interface between the 
intranet 104 and another network, such as the Internet 1 10. The e-mail server computer 
102 is also operative to execute an e-mail server application program for storing and 
forwarding self-destructing e-mail messages. The e-mail server application may also 
30 provide other services with respect to self-destructing e-mail messages such as 
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providing e-mail messages confirming the deletion of a self-destructing e-mail message, 
providing requests to e-mail client applications to destroy self-destructing e-mail 
messages, and other functions. Additionally, the e-mail server application may store 
and forward self-destructing e-mail messages and non self-destructing e-mail messages 
5 to computers connected to the intranet 104, such as the client computer 106 A, and to 
computers connected to external networks, such as the client computer 106B. 
Additional details regarding the operation of the e-mail server computer 102 are 
provided below with respect to FIGURES 2 and 10. 

Referring now to FIGURE 2, an illustrative computer architecture for the e-mail 
10 server computer 102 will be described. The computer architecture shown in FIGURE 2 
illustrates a conventional network-capable computer system, including a central 
processing unit 202 ("CPU"), a system memory 204, including a random access 
memory 214 ("RAM") and a read-only memory ("ROM") 216, and a system bus 206 
1X1 that couples the memory to the CPU 202. A basic input/output system ("BIOS") 

15 containing the basic routines that help to transfer information between elements within 
the e-mail server computer 102, such as during startup, is stored in the ROM 216. The 
e-mail server computer 102 further includes a mass storage device 208 for storing an 
operating system 218 and application programs 220. 

The mass storage device 208 is connected to the CPU 202 through a mass 
20 storage controller (not shown) connected to the bus 206. The mass storage device 208 
and its associated computer-readable media provide non-volatile storage for the e-mail 
server computer 102. Although the description of computer-readable media contained 
herein refers to a mass storage device, such as a hard disk or CD-ROM drive, it should 
be appreciated by those skilled in the art that computer-readable media can be any 
25 available media that can be accessed by the e-mail server computer 1 02. 

By way of example, and not limitation, computer-readable media may comprise 
computer storage media and communication media. Computer storage media includes 
volatile and non-volatile, removable and non-removable media implemented in any 
method or technology for storage of information such as computer-readable 
30 instructions, data structures, program modules or other data. Computer storage media 
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includes, but is not limited to, RAM, ROM, EPROM, EEPROM, flash memory or other 
solid state memory technology, CD-ROM, DVD, or other optical storage, magnetic 
cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or 
any other medium which can be used to store the desired information and which can be 
5 accessed by the e-mail server computer 1 02. 

As described briefly above, the e-mail server computer 102 connects to the 
intranet 104 or other type of network through a network interface unit 210 connected to 
the bus 206. The e-mail server computer 102 may also include an input/output 
controller 212 for receiving and processing input from a number of devices, including a 
u 10 keyboard or mouse. Similarly, the input/output controller 212 may provide output to a 

display screen, a printer, or other type of output device. 

A number of program modules may be stored in the mass storage device 208 
LJf and RAM 214 of the e-mail server computer 102, including an operating system 218 

1/1 suitable for controlling the operation of a networked computer system, such as the 

Jz 

T 15 UNIX operating system, the SOLARIS operating system from SUN 

MICROSYSTEMS, or the WINDOWS 2000 operating system from MICROSOFT 
CORPORATION of Redmond, Washington. The mass storage device 208 and 
RAM 214 may also store one or more application programs 220. In particular, the mass 
storage device 208 and RAM 214 may store an e-mail server application program 222, 
20 an e-mail database 224, and one or more self-destructing e-mail messages 226. 

The e-mail server application 222 provides functionality for storing and 
forwarding self-destructing e-mail messages 226 and non self-destructing e-mail 
messages. As mentioned above, the e-mail server application 222 may also provide 
other services with respect to self-destructing e-mail messages such as providing e-mail 
25 messages confirming the deletion of a self-destructing e-mail message 226, providing 
requests to e-mail client applications to destroy self-destructing e-mail messages, and 
other functions. In order to provide this functionality, the e-mail server application 222 
maintains an e-mail database 224 for storing self-destructing e-mail messages. The e- 
mail server application 222 may also maintain other databases and tables for providing 
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self-destructing e-mail messages. Additional details regarding the operation of the e- 
mail server application 222 will be provided below with reference to FIGURE 10. 

Referring now to FIGURE 3, an illustrative computer architecture for an e-mail 
client computer 106 A utilized in various embodiments of the present invention will be 
5 described. The e-mail client computer 106 A comprises a standard personal computer 
capable of sending and receiving e-mail messages over a computer network. As shown 
in FIGURE 3, the e-mail client computer 106 A includes many of the convention 
computer components utilized in the e-mail server computer 102, including a CPU 202, 
a network interface unit 210 for connecting to an intranet 104 or other type of network, 
10 a system memory 204 and a mass storage device 208. The mass storage device 208 and 
RAM 214 also includes an operating system 218 suitable for controlling the operation 
of a standard personal computer, such as the WINDOWS 2000 or WINDOWS ME 
operating systems from MICROSOFT CORPORATION of Redmond, Washington. 

The mass storage device 208 and RAM 214 may also store an e-mail client 
15 application 302 and an e-mail database 304 containing one or more self-destructing e- 
mail messages 226. As will be described in greater detail below, the e-mail client 
application 302 is operative to send and receive self-destructing e-mail messages 226. 
Moreover, the e-mail client application 302 may limit the number and type of 
operations that may be performed on self-destructing e-mail messages. For instance, 
20 the e-mail client application 302 may prohibit a user from saving, copying, printing, or 
otherwise duplicating the self-destructing e-mail messages 226 stored at the client 
computer 106A. Additional details regarding the operation of the e-mail client 
application 302 will be described with reference to FIGURES 4-9, below. 

Referring now to FIGURE 4, a user interface diagram illustrating a user 
25 interface provided in an embodiment of the e-mail client application 302 will be 
described. As shown in FIGURE 4, the e-mail client application 302 provides a user 
interface window 402 that may be utilized to send, receive and perform other functions 
on e-mail messages. In particular, the user interface window 402 includes a received e- 
mail list 404. The received e-mail list 404 identifies the date sent, the sender, the 
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subject, and the date received for e-mail messages received at the client computer 106A. 
Other information regarding these e-mail messages may be similarly provided. 

The user interface window 402 also includes a number of user interface buttons 
406A - 4061 for creating new e-mail messages and for performing operations on 
received e-mail messages. In particular, user interface button 406A allows a user to 
create a new e-mail message in a conventional manner. The user interface buttons 
406B and 406C allow a user to reply to or forward an e-mail message, respectively. 
The user interface buttons 406E - 4061 allow e-mail messages to be saved, printed, 
pasted from a clipboard, cut, or copied to a clipboard, respectively. 

Accordingly to one embodiment of the present invention, the e-mail client 
application 302 restricts the set of operations that may be performed on a self- 
destructing electronic mail message selected in the received e-mail list 404. For 
instance, if a self-destructing e-mail message is selected in the received e-mail list 404, 
the user interface buttons 406B, 406C, 406E, 406F, 406G, 406H, and 4061 may be made 
unavailable thereby preventing a user from performing any of these operations on the 
self-destructing e-mail message. In this manner, the e-mail client application 302 can 
prohibit the duplication of the selected message through forwarding, saving, moving, 
copying, cutting, printing, or pasting. Moreover, the e-mail client application 302 may 
instruct the operating system 218 to prevent a screen display containing a self- 
destructing e-mail message from being captured or printed. It should be appreciated 
that the group of operations that the e-mail client application 302 restricts from being 
executed on a self-destructing e-mail message described herein is merely illustrative 
and that other operations that result in the duplication of all or a part of an e-mail 
message may be similarly prohibited. 

As shown in FIGURE 4, the user interface window 402 also includes a user 
interface button 406D for sending a new self-destructing e-mail message. Selection of 
the user interface button 406D by a user allows the user to specify a group of recipients 
for the self-destructing e-mail message and a time period within which the self- 
destructing e-mail message should be destroyed. FIGURE 5 shows a user interface 
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provided by the e-mail client application 302 for creating a new self-destructing e-mail 
message. 

Referring now to FIGURE 5, an illustrative user interface for sending a new 
self-destructing e-mail message will be described. As shown in FIGURE 5, the e-mail 
5 client application 302 displays a user interface window 502 in response to the selection 
of the user interface button 406D for creating a new self-destructing e-mail message. 
As shown in FIGURE 5, the user interface window 502 includes conventional buttons 
504A - 504D for selecting the primary recipients, carbon copy recipients, blind carbon 
copy recipients, and subject for the new self-destructing e-mail message. The user 

10 interface window 502 also contains a field 506 for providing the message body. The 
user interface window 502 also includes user interface buttons 504E and 504F for 
sending the new message or canceling the message, respectively. Additionally, the user 
interface window 502 includes a user interface button 504 for allowing the user to select 
the time period within which the self-destructing electronic mail message should be 

15 destroyed. If the user selects the user interface button 504G, the user is presented with a 
user interface window 602 for selecting the time period for destruction of the e-mail 
message. 

Referring now to FIGURE 6, a user interface window 602 will be described that 
allows a sender to set the time period for the destruction of a self-destructing e-mail 

20 message. As shown in FIGURE 6, a number of radio buttons 604A - 604D are provided 
that allow a user to select options relating to the time period within which a self- 
destructing e-mail message should be destroyed. The radio button 604A allows the user 
to indicate that the self-destructing e-mail message should be destroyed after it has been 
read on the e-mail client application 302. 

25 For instance, the message may be destroyed after it has been opened and closed 

by the recipient. Alternatively, the e-mail client application 302 may wait a 
predetermined amount of time after the message has been closed before deleting it. The 
radio button 604B allows the user to indicate that the self-destructing e-mail message 
should be destroyed in a user-specified number of hours. The radio button 604C 

30 similarly allows the user to specify that the self-destructing e-mail message should be 
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destroyed within a specified number of days. The radio button 604D allows the user to 
specify a particular date on which the self-destructing e-mail message should be 
destroyed. The new self-destructing e-mail message will be destroyed from the 
recipient's e-mail client application 302 and computer system according to the options 
5 selected here by the user utilizing radio buttons 604A - 604D. 

The user interface window 602 also provides several other options relating to the 
new self-destructing e-mail message. In particular, option 606 allows the sender to 
specify that a confirmation e-mail message should be sent from the e-mail server 
computer 102 to the recipient when the self-destructing e-mail message has been 

1 = io deleted. According to one embodiment of the present invention, the confirmation e- 

2 mail includes the identity of the sender of the original self-destructing e-mail message 
J and an indication that the self-destructing e-mail message was sent but destroyed. In 
gj this manner, a recipient may be notified that a self-destructing e-mail message was 

received and destroyed even though the recipient never saw the message. The 
15 confirmation message includes only non-confidential information and does not include 
the message body or attachments originally included with the self-destructing e-mail 
message. 

Selection of the option 608 allows the sender to indicate whether or not a return 
receipt should be provided to the sender when the recipient has read the self-destructing 
20 e-mail message. The return receipt may also provide a confirmation that the self- 
destructing e-mail message has been deleted from the recipient's computer. 
Additionally, option 610 allows the sender to indicate that the self-destructing e-mail 
message should be encrypted prior to being sent. According to one embodiment of the 
present invention, the e-mail client application 302 has the capability of decrypting 
25 encrypted self-destructing e-mail messages. In this manner, a self-destructing e-mail 
message that was transmitted to an e-mail client application not configured to receive 
self-destructing e-mail messages would be unreadable. Once the user has completed the 
selection of the time period within which the self-destructing e-mail message should be 
destroyed and the other delivery options, the user may return to the user interface 
30 window 502 shown in FIGURE 5 by selecting the "done" button 611. 
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When the user has completed the forms of the user interface window 502 shown 
in FIGURE 5, the user may select the user interface button 504E to send the message. 
Prior to sending the message, the e-mail client application 302 may determine whether 
any of the intended recipients are located on a network physically or logically beyond 
5 the sender's home e-mail domain. For instance, if the user's home e-mail address is 
"user@bellsouth.com", the e-mail client application 302 would determine whether any 
of the intended recipient's e-mail addresses are located at a domain other than 
"bellsouth.com." In the event that the e-mail client application 302 determines that one 
or more of the intended recipients is located on a network beyond the sender's home 
10 domain, the security warning message shown in FIGURE 7 is displayed. As shown in 
FIGURE 7, the user interface window 702 includes a security warning message that 
indicates to the sender that an intended recipient of the self-destructing e-mail message 
is located beyond a home domain associated with the e-mail server application 222. 
The user is then given the option to proceed with sending the self-destructing e-mail 
15 message or canceling the e-mail message. In this manner, the distribution of the self- 
destructing e-mail message to an e-mail system beyond the sender's home domain may 
O be monitored and controlled by the user. This allows the user to ensure that the e-mail 

client application 302 that receives the self-destructing e-mail message supports the 
features described herein and that the self-destructing e-mail message will be destroyed 
20 by the e-mail client application 302 as specified by the user. 

Referring now to FIGURE 8, a state machine 800 will be described illustrating 
aspects of the operation of the e-mail client application 302 according to one actual 
embodiment of the present invention. The state machine 800 begins at state 802, the e- 
mail client application 302 home state. In the home state 802, the e-mail client 
25 application displays the user interface window 402 shown in FIGURE 4 and receives 
user input. As will be described in greater detail below, the e-mail client application 
302 also receives messages in the home state 802 and determines whether self- 
destructing e-mail messages should be destroyed. In particular, from the home state 
802, the e-mail client application 302 periodically transitions to state 804 where it 
30 contacts the e-mail server computer 102 and receives e-mail messages. The messages 
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received from the e-mail server computer 102 may comprise self-destructing e-mail 
messages or non self-destructing e-mail messages. 

Once messages have been received, the state machine 800 transitions from state 
804 to state 806 where any encrypted e-mail messages received from the e-mail server 
5 computer 102 are decrypted. The state machine 800 then transitions to state 808, where 
the e-mail client application 302 stores the received e-mail messages in the e-mail 
database 304. From state 808, the e-mail client application 302 returns to the home 
state 802. 

At the home state 802, the e-mail client application 302 also periodically checks 
10 to determine whether any self-destructing e-mail messages contained in the e-mail 
database 224 are scheduled to be destroyed. To perform this processing, the state 
machine 800 transitions from state 802 to state 810 where a determination is made as to 
whether any of the self-destructing e-mail messages contained in the e-mail database 
304 should be destroyed. This determination may include comparing the time or date 
15 on which a particular self-destructing e-mail message should be destroyed with the 
current time maintained by the client computer 106 A. If no self-destructing e-mail 
messages are to be destroyed, the state machine 800 returns to the home state 802. If, 
however, self-destructing e-mail messages are scheduled to be destroyed, the state 
machine 810 transitions to state 812. At state 812, the self-destructing e-mail message 
20 scheduled to be destroyed is deleted from the e-mail database 304 and removed from all 
portions of the system memory 204 and the mass storage device 208 of the client 
computer 106 A. In this manner, each and every instance of the self-destructing e-mail 
message is deleted. From state 812, the state machine 800 returns to the home state 
802. 

25 While in the home state 802, the e-mail client application 302 may also receive a 

request from a user to perform an operation on one of the e-mail messages listed in the 
received e-mail list 404. For instance, the e-mail client application 302 may receive a 
request from a user via the selection of the user interface button 406F to print a selected 
e-mail message. When such a request to perform an operation is received, the state 

30 machine 800 transitions from state 802 to state 814. At state 814, the e-mail client 
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application 302 makes a determination as to whether the requested operation is a 
restricted operation that should not be performed on the selected e-mail message. 
According to one embodiment of the present invention, the e-mail client application 302 
determines whether a requested operation is a restricted operation by determining 
5 whether the selected e-mail message upon which the operation should be performed is a 
self-destructing e-mail message. If the e-mail upon which the operation is to be 
performed is a self-destructing e-mail message, any operation that would result in the 
duplication of any or all of the contents of the self-destructing e-mail message in any 
form will be restricted. For instance, operations for forwarding, saving, printing, 
Li, 10 pasting, cutting, copying, moving, and other similar operations may be restricted. 

If, at state 814, the e-mail client application 302 determines that the requested 
operation is not a restricted operation, the state machine 800 transitions to state 818, 
where the requested operation is performed. If, however, at state 814 the e-mail client 
application 302 determines that the requested operation is a restricted operation, the 
■ 15 state machine 800 will transition to state 816, where the requested operation is 

y| prohibited. A visual or audio indication may be provided to the user that the requested 

operation cannot be performed on a self-destructing e-mail message. From states 816 
and 818 the state machine 800 returns to the e-mail client application home state 802. 

Referring now to FIGURE 9, a state machine 900 will be described that 
20 illustrates additional aspects of the operation of the e-mail client application 302. Like 
the state machine 800, the state machine 900 begins in the e-mail client application 
home state 802. If a request is received to send a new self-destructing e-mail message 
while the e-mail client application 302 is in the home state 802, the state machine 900 
transitions from state 802 to state 908. At state 908, a user interface window for 
25 providing information regarding the recipients, subject, and message body is displayed 
to the user. An illustrative user interface window 502 for collecting this information is 
described above with reference to FIGURE 5. Once this information has been received 
from the user, the state machine 900 transitions from state 908 to state 910. 

At state 910, the time period within which the self-destructing e-mail message 
30 should be destroyed is also received from the user. As described above with reference 
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to FIGURE 6, this information may include an elapsed number of hours or days within 
which the message should be destroyed, a particular date on with which the message 
should be destroyed, or an indication from the user that the message should be 
destroyed immediately after it is read by the recipient. Once this information has been 
received from the sender, the state machine 900 continues to state 912. 

At state 912, the e-mail client application 302 makes a determination as to 
whether any of the intended recipients of the new self-destructing e-mail message are 
outside the sender's home e-mail domain. If any of the intended recipients are outside 
the user's home e-mail domain, the state machine 900 transitions to state 916, where a 
security warning is provided to the sender as shown and described above with respect to 
FIGURE 7. If the sender chooses to cancel the transmission of the message as a result 
of the security warning, the state machine 900 transitions from state 916 to state 918, 
where the self-destructing e-mail message is cancelled. The state machine then 
transitions from state 918 to the home state 802. 

If, at state 912, the e-mail client application 302 determines that none of the 
intended recipients are beyond the sender's home e-mail domain, the state machine 912 
transitions to state 914. Similarly, if at state 916, the e-mail client application 302 
determines that the sender would like to continue sending the self-destructing e-mail 
message even after receiving the security warning, the state machine 900 transitions 
from state 916 to state 914. 

At state 914, the e-mail client application 302 transmits a request to the e-mail 
server computer 102 to send the self-destructing e-mail message to the intended 
recipients. As a part of the request from the e-mail client application 302 to the e-mail 
server computer 102, the message body 506 and the time period within which the self- 
destructing electronic mail message should be destroyed are sent to the e-mail server 
computer 102. This information is then forwarded from the e-mail server computer 102 
to each of the intended recipients and may be utilized by e-mail client applications 302 
executing on each of the recipients' client computers to delete the self-destructing e-mail 
message at the appointed time. As will be described in greater detail below with respect 
to FIGURE 10, this information may also be utilized at the e-mail server computer 102 
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to destroy all instances of the self-destructing e-mail message from the e-mail server 
computer 102. Once the request to transmit the self-destructing e-mail message has 
been transmitted to the e-mail server computer, the state machine 900 transitions from 
state 914 back to the home state 802. 
5 While in the home state 802, the e-mail client application 302 may also receive a 

request from a user to read one of the messages identified in the received e-mail list 
404. In response to such a request, the state machine 900 transitions from the home 
state 802 to state 902. At state 902, the e-mail message selected by the user is displayed 
in a conventional manner. When the displayed e-mail message is closed by the user, the 
M 10 state machine 900 transitions from state 902 to state 904. At state 904, the e-mail client 

p application 302 makes a determination as to whether the displayed e-mail message 

j! should be destroyed. According to one embodiment of the present invention, this 

CO determination is made by the e-mail client application 302 by examining information 

111 

jf associated with self-destructing e-mail messages that indicate that these messages 

15 should be destroyed after they have been read by the recipient. If such information is 
not associated with the displayed e-mail message, the message is simply closed and the 
state machine returns from state 904 to the home state 802. 
y If information is associated with the e-mail message indicating that it should be 

destroyed after being opened and closed, the state machine 900 transitions from state 
20 904 to state 906. At state 906, the self-destructing e-mail message is deleted from the e- 
mail database 304. Other instances of the self-destructing e-mail message contained in 
the system memory 204 or the mass storage device 208 are also deleted. In this manner, 
all instances of the self-destructing e-mail message stored on the client computer 106 A 
are eliminated. From state 906, the state machine 900 returns to the home state 802 
25 where additional requests may be processed. 

Referring now to FIGURE 10, a state machine 1000 will be described that 
illustrates additional aspects of the operation of the e-mail server application 222. The 
state machine 1000 begins at state 1002, the e-mail server application 222 home state. 
The e-mail server application 222 performs a variety of processing tasks while in the 
30 home state 1002, including receiving and forwarding e-mail messages and determining 
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whether any self-destructing e-mail messages should be destroyed from the e-mail 
server computer 102. In particular, if the e-mail server application 222 receives a 
request from an e-mail client application 302 to transmit a self-destructing e-mail 
message, the state machine 1000 transitions from state 1002 to state 1004. 
5 At state 1004, the e-mail server application 222 encrypts the received message if 

the sender has indicated that the message should be encrypted. As mentioned above, 
encrypting a self-destructing e-mail message ensures that only e-mail client applications 
that support the timely destruction of such e-mail messages can read these messages. 
Alternatively, encryption of the e-mail message may be performed at the e-mail client 
10 application 302 prior to sending the message. From state 1004, the state machine 1000 
continues to state 1006, where the e-mail server 222 transmits the self-destructing e- 
J; mail message to each of the intended recipients identified by the sender. The state 

BO machine 1000 then transitions from state 1006 back to the e-mail server application 

If* 

li home state 1002. 

^ 15 The e-mail server application 222 also periodically checks to determine whether 

ha any self-destructing e-mail messages should be deleted from the e-mail server computer 

~2 102. This ensures that all instances of the e-mail will be destroyed from both the client 

O computer 106A and the e-mail server computer 102. When such a check is to be 

performed, the state machine 1000 transitions to state 1008. At state 1008, the e-mail 
20 server application 222 determines whether any messages to be destroyed are contained 
in the e-mail database 224. If no messages are to be destroyed, the state machine 
returns from state 1008 to the home state 1002. If messages are contained in the e-mail 
database 224 that are scheduled for destruction, the state machine 1000 transitions from 
state 1008 to state 1010. At state 1010, all self-destructing e-mail messages that are 
25 scheduled to be destroyed contained in the e-mail database 224 are removed. 
Additionally, the e-mail server computer 102 may remove all instances of the self- 
destructing e-mail message from the system memory 204 or other locations on the mass 
storage device 208. 

Once all instances of the self-destructing e-mail messages have been destroyed 
30 from the e-mail server computer 102, the state machine 1000 transitions from state 1010 
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to state 1012. At state 1012, the e-mail server application 222 may send a notification 
to the recipients and the senders instructing their e-mail client applications 302 to 
destroy all instances of the e-mail message. This notification may be performed as a 
backup to the functionality provided by the e-mail client application 302 for destroying 
5 instances of the self-destructing e-mail message. 

From state 1012, the state machine 1000 transitions to state 1014. At state 1014, 
the e-mail server application 222 sends a notification e-mail message to each of the 
recipients of the deleted self-destructing e-mail message. As mentioned above, the 
notification e-mail includes the identity of the sender of the self-destructing e-mail 
H 10 message along with an indication that the self-destructing e-mail message was sent but 

q destroyed. In this manner, a recipient may learn of the fact that the e-mail message was 

J: sent but destroyed. The state machine 1000 then returns from state 1014 to the home 

state 1002, where the e-mail server application 222 continues its processing. 

In view of the above, it should be appreciated that embodiments of the present 
15 invention provide a method, system, computer-controlled apparatus, and computer- 
readable medium for providing self-destructing e-mail messages. The above 
specification, examples and data provide a complete description of the manufacture and 
use of the composition of the invention. Since many embodiments of the invention can 
be made without departing from the spirit and scope of the invention, the invention is 
20 defined by the claims hereinafter appended. 
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